CVE-2026-116840

Published: Oct 27, 2026Modified: Oct 27, 2026

6.9

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (6)

https://github.com/ggml-org/llama.cpp/blob/v0.5.0/ggml/src/gguf.cpp#L794-L795

Source: disclosure@vulncheck.com

https://github.com/ggml-org/llama.cpp/commit/a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44

Source: disclosure@vulncheck.com

https://github.com/ggml-org/llama.cpp/issues/26978

Source: disclosure@vulncheck.com

https://github.com/ggml-org/llama.cpp/pull/26979

Source: disclosure@vulncheck.com

https://github.com/ggml-org/llama.cpp/releases/tag/b11275

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/llama-cpp-b5854-before-b11275-integer-overflow-in-gguf-init-from-reader

Source: disclosure@vulncheck.com

Timeline

No history available yet.